Platform Tool Auth and Webhooks

Auth types

Platform tools can use: OAuth2, API key, access key, connection string, or none. Configure connections at the team level; workflows reference the connection.

Webhook trigger URL format is app/workflow/hook/:platform/:webhook_token where :webhook_token is the rotatable token shown in the trigger panel. Older webhooks still resolve at app/workflow/hook/:platform/:app/:workflow/:trigger for backward compatibility.

Webhook providers

For workflow triggers:

• Slack – platform slack; validates x-slack-signature and timestamp.
• Stripe – platform stripe; validates stripe-signature.
• GitHub – platform github; validates x-hub-signature-256.
• GitLab – platform gitlab; validates x-gitlab-token.
• Shopify – platform shopify; validates x-shopify-hmac-sha256.
• Other – platform other; send HMAC of raw body in x-signature:

x-signature: <hmac-sha256-of-raw-body>

Server validates using the trigger's webhook_secret. Use the webhook URL and secret in the external service.